logo_kerberos.gif

Difference between revisions of "Solaris Build Environment"

From K5Wiki
Jump to: navigation, search
(Set up OpenCSW)
(Install required OpenCSW packages)
 
(20 intermediate revisions by 2 users not shown)
Line 1: Line 1:
This page contains notes on the setup of a Solaris buildbot worker for MIT krb5.
+
This page contains notes on the setup of a Solaris buildbot worker for MIT krb5. The current buildbot worker is krbdev-sparc-build.mit.edu.
   
 
Our current Solaris build hardware is a Sun Fire V240 running Solaris 10 U10.
 
Our current Solaris build hardware is a Sun Fire V240 running Solaris 10 U10.
Line 21: Line 21:
 
pkgadd -d http://get.opencsw.org/now
 
pkgadd -d http://get.opencsw.org/now
 
pkgutil -U
 
pkgutil -U
edit /etc/passwd and change the home directory of "games" to /
 
   
 
"pkgutil -l" lists installed packages. "pkgutil -a string" looks up string in the catalog. "pkgutil -i packagename" installs a package; the -y flag can be used to skip prompts. "pkgutil -U" followed by "pkgutil -yu" updates all installed packages.
 
"pkgutil -l" lists installed packages. "pkgutil -a string" looks up string in the catalog. "pkgutil -i packagename" installs a package; the -y flag can be used to skip prompts. "pkgutil -U" followed by "pkgutil -yu" updates all installed packages.
 
OpenCSW appears to create a "games" account with the home directory set to /opt/csw. This would ordinarily allow ssh access by the Kerberos principal games@ATHENA.MIT.EDU. We change the home directory of this account to / so that /.k5login governs access.
 
   
 
==Install required OpenCSW packages==
 
==Install required OpenCSW packages==
Line 37: Line 34:
 
pkgutil -y -i openldap_dev
 
pkgutil -y -i openldap_dev
 
pkgutil -y -i autoconf
 
pkgutil -y -i autoconf
  +
pkgutil -y -i tcl
  +
pkgutil -y -i tcl_dev
 
pkgutil -y -i expect
 
pkgutil -y -i expect
  +
pkgutil -y -i bind_utils
 
pkgutil -y -i bison
 
pkgutil -y -i bison
  +
pkgutil -y -i python33
 
pkgutil -y -i buildbot_slave
 
pkgutil -y -i buildbot_slave
 
pkgutil -y -i emacs
 
pkgutil -y -i emacs
 
pkgutil -y -i gdb
 
pkgutil -y -i gdb
 
edit /etc/passwd and change the home directory of "games" to /
   
We have decided not to support the Solaris 10 native LDAP library and tools (Solaris 11 ships with OpenLDAP and Solaris 12 will make it the default), so we install OpenLDAP from OpenCSW. OpenSSL 0.9 is present in /usr/sfw/lib, but we need 1.0 or later for PKINIT so we install the OpenCSW version. The bison in /usr/sfw/bin is also too old for our x-deltat.y file. emacs and gdb are not needed to build krb5, but are handy to have around for manual testing and debugging work.
+
We have decided not to support the Solaris 10 native LDAP library and tools (Solaris 11 ships with OpenLDAP and Solaris 12 will make it the default), so we install OpenLDAP from OpenCSW. OpenSSL 0.9 is present in /usr/sfw/lib, but we need 1.0 or later for PKINIT so we install the OpenCSW version. The bison in /usr/sfw/bin is also too old for our x-deltat.y file. buildbot_slave requires Python 2.7 but does not list it as a formal dependency. emacs and gdb are not needed to build krb5, but are handy to have around for manual testing and debugging work.
   
 
buildbot 0.9 changes its terminology to refer to "workers" rather than "slaves". At the time of this writing, OpenCSW only includes buildbot 0.8.4; when it switches to buildbot 0.9, the package we need will likely change to buildbot_worker.
 
buildbot 0.9 changes its terminology to refer to "workers" rather than "slaves". At the time of this writing, OpenCSW only includes buildbot 0.8.4; when it switches to buildbot 0.9, the package we need will likely change to buildbot_worker.
  +
 
One of the above packages appears to create a "games" account with the home directory set to /opt/csw. This would ordinarily allow ssh access by the Kerberos principal games@ATHENA.MIT.EDU. We change the home directory of this account to / so that /.k5login governs access.
   
 
==Local builds of remaining dependencies==
 
==Local builds of remaining dependencies==
Line 53: Line 57:
 
mkdir /usr/local /usr/local/src
 
mkdir /usr/local /usr/local/src
 
From https://ftp.gnu.org/gnu/dejagnu/ fetch the latest dejagnu; untar it in /usr/local/src
 
From https://ftp.gnu.org/gnu/dejagnu/ fetch the latest dejagnu; untar it in /usr/local/src
  +
chown -R root:root /usr/local/src/dejagnu-''version''
 
cd /usr/local/src/dejagnu-''version''
 
cd /usr/local/src/dejagnu-''version''
 
./configure && gmake install
 
./configure && gmake install
   
 
==Set up buildbot==
 
==Set up buildbot==
 
This section is under development.
 
   
 
Create and switch to the buildbot account:
 
Create and switch to the buildbot account:
Line 65: Line 68:
 
su - buildbot
 
su - buildbot
 
touch .k5login
 
touch .k5login
  +
edit .profile and add:
  +
PATH=/usr/local/bin:/opt/csw/bin:/usr/bin:/usr/sfw/bin:/usr/ccs/bin
  +
MANPATH=/usr/local/share/man:/opt/csw/share/man:/usr/share/man:/usr/sfw/share/man
  +
USER=buildbot
  +
export PATH MANPATH USER
   
 
Principals may be added to .k5login, but make sure it exists so that the Kerberos principal "buildbot" does not have access to the account.
 
Principals may be added to .k5login, but make sure it exists so that the Kerberos principal "buildbot" does not have access to the account.
   
Set up ssh for the ssh tunnel to krbdev.mit.edu:
+
Set up ssh for the ssh tunnel to krbdev-buildbot.mit.edu:
   
 
mkdir .ssh
 
mkdir .ssh
ssh-keygen -q -N '' -f .ssh/id_rsa -t rsa
+
ssh-keygen -q -N <nowiki>''</nowiki> -f .ssh/id_rsa -t rsa
 
cat .ssh/id_rsa.pub
 
cat .ssh/id_rsa.pub
In a separate shell, log into krbdev.mit.edu, "su -s /bin/bash - buildbot" and add the contents of id_rsa.pub to .ssh/authorized_keys
+
In a separate shell, log into krbdev-buildbot.mit.edu, "su -s /bin/bash - buildbot" and add the contents of id_rsa.pub to .ssh/authorized_keys
Edit .ssh/known_hosts (new file) and add:
+
Run "/usr/bin/ssh -l buildbot krbdev-buildbot.mit.edu" to add the host key to .ssh/known-hosts. Check the key fingerprint against "ssh-keygen -l -E md5 -f /etc/ssh/ssh_host_rsa_key.pub"
krbdev.mit.edu,18.9.62.43 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAmV2SWbD5nZah7F0nhzEpBtmdiNa38TTDx58i/HhENlT3yV4xpwyHcqBSObUR+wQlW+LfBRgyGeXEZAoiEMG4kQk93P+JKEsK5G/X9QF2LICsoMSZKW31S1K4axqtlhesFnnlXzZZkWQhYhG3He8DXBBw+2AMWR6jfTnM634fGpl5Vo76r7QuxL09RpnSEZyihR/6n8IG8EaAyX4Rbj23pkLlj6DjfWoYd1CmjN+JKiZ9q/yXHQMW+/yMo+JhmAPwgBVjQkc/pDfVFffavWzRPJ39ZUbRRNBSHU0lweXLcCIq6K4P+Mvt/WKwsFNxASNOOmkbWVDfNflT8L1maFCr7w==
+
  +
Create the slave directory:
  +
  +
mkdir slaves
  +
buildslave create-slave /var/lib/buildbot/slaves/s01 127.0.0.1:9989 s01 ''password''
  +
  +
where ''password'' should match the entry for s01 in slaves.py on krbdev-buildbot.mit.edu.
  +
  +
As root, create /etc/init.d/buildslave with the contents:
  +
  +
#!/sbin/sh
  +
case "$1" in
  +
start)
  +
su buildbot -c 'ssh -l buildbot -N -L9989:127.0.0.1:9989 krbdev-buildbot.mit.edu &'
  +
su - buildbot -c 'buildslave start --quiet /var/lib/buildbot/slaves/s01'
  +
;;
  +
stop)
  +
su buildbot -c '/opt/csw/bin/buildslave stop --quiet /var/lib/buildbot/slaves/s01'
  +
;;
  +
esac
  +
exit 0
  +
  +
Make it executable with "chmod u+x /etc/init.d/buildslave". Create the following links:
  +
  +
ln -s /etc/init.d/buildslave /etc/rc2.d/S99buildslave
  +
ln -s /etc/init.d/buildslave /etc/rc2.d/K00buildslave
  +
  +
We do not currently stop the ssh tunnel automatically, because it isn't easy to do. The ssh tunnel must be manually restarted if it breaks; on other workers, we use a cron job which runs "ssh -oExitOnForwardFailure=yes ...", but the Solaris 10 ssh does not support that option. The start rule will display an unwanted copy of /etc/motd; an alternative would be to explicitly set the path when running buildbot, instead of relying on buildbot's .profile.
   
 
==Create user accounts==
 
==Create user accounts==
Line 97: Line 105:
 
==To do==
 
==To do==
   
* t_kdb.py does not know how to find the OpenCSW slapd. Making a copy of /opt/csw/libexec/slapd won't work, because it is a script which chooses an executable based on the architecture and the path to the script.
 
 
* We should install the SunPro compiler and do automated builds with that compiler as well as gcc.
   
* The system needs to be set up as a buildbot worker.
 
  +
==Hardware notes==
   
* We should install the SunPro compiler and do automated builds with that compiler as well as gcc.
 
  +
The 8-pin modular serial connector for console/ALOM takes a shielded UTP cable. (The shielding probably isn't too important except for EMI reasons.) The modular to female DE-9 adapter is wired as a RS-232 DCE so it will plug directly into most USB to DE-9 RS-232 adapters. (The modular to male DB-25 adapter seems to be wired as a DTE and might need a null modem.)

Latest revision as of 11:54, 12 July 2018

This page contains notes on the setup of a Solaris buildbot worker for MIT krb5. The current buildbot worker is krbdev-sparc-build.mit.edu.

Our current Solaris build hardware is a Sun Fire V240 running Solaris 10 U10.

Solaris 10 includes a variety of free software tools in /usr/sfw, but not the full set of dependencies needed to checkout, build, and test the krb5 tree. We have chosen to use OpenCSW to add most of the dependencies, and local builds in /usr/local for the remaining few.

Set up a useful shell

A root login by default uses a very minimal shell (/bin/sh) with a very minimal path (/usr/sbin:/usr/bin). For any operations performed as root, we begin by starting a functional shell as follows:

   bash
   export PATH=/opt/csw/bin:/usr/sbin:/usr/bin:/usr/sfw/bin:/usr/ccs/bin
   export MANPATH=/opt/csw/share/man:/usr/share/man:/usr/sfw/share/man

For now, we are not modifying /etc/passwd or root's dotfiles to make this happen automatically.

Set up OpenCSW

Installing the pkgutil command (it will be placed in /opt/csw/bin) and update its catalog as follows:

   pkgadd -d http://get.opencsw.org/now
   pkgutil -U

"pkgutil -l" lists installed packages. "pkgutil -a string" looks up string in the catalog. "pkgutil -i packagename" installs a package; the -y flag can be used to skip prompts. "pkgutil -U" followed by "pkgutil -yu" updates all installed packages.

Install required OpenCSW packages

   pkgutil -y -i git
   pkgutil -y -i libssl_dev
   mkdir /opt/csw/sbin/sparcv9  # to work around an apparent bug in openldap package
   pkgutil -y -i openldap
   pkgutil -y -i openldap_back_bdb
   pkgutil -y -i openldap_client
   pkgutil -y -i openldap_dev
   pkgutil -y -i autoconf
   pkgutil -y -i tcl
   pkgutil -y -i tcl_dev
   pkgutil -y -i expect
   pkgutil -y -i bind_utils
   pkgutil -y -i bison
   pkgutil -y -i python33
   pkgutil -y -i buildbot_slave
   pkgutil -y -i emacs
   pkgutil -y -i gdb
   edit /etc/passwd and change the home directory of "games" to /

We have decided not to support the Solaris 10 native LDAP library and tools (Solaris 11 ships with OpenLDAP and Solaris 12 will make it the default), so we install OpenLDAP from OpenCSW. OpenSSL 0.9 is present in /usr/sfw/lib, but we need 1.0 or later for PKINIT so we install the OpenCSW version. The bison in /usr/sfw/bin is also too old for our x-deltat.y file. buildbot_slave requires Python 2.7 but does not list it as a formal dependency. emacs and gdb are not needed to build krb5, but are handy to have around for manual testing and debugging work.

buildbot 0.9 changes its terminology to refer to "workers" rather than "slaves". At the time of this writing, OpenCSW only includes buildbot 0.8.4; when it switches to buildbot 0.9, the package we need will likely change to buildbot_worker.

One of the above packages appears to create a "games" account with the home directory set to /opt/csw. This would ordinarily allow ssh access by the Kerberos principal games@ATHENA.MIT.EDU. We change the home directory of this account to / so that /.k5login governs access.

Local builds of remaining dependencies

dejagnu is not present in OpenCSW, so we need to build it ourselves:

   mkdir /usr/local /usr/local/src
   From https://ftp.gnu.org/gnu/dejagnu/ fetch the latest dejagnu; untar it in /usr/local/src
   chown -R root:root /usr/local/src/dejagnu-version
   cd /usr/local/src/dejagnu-version
   ./configure && gmake install

Set up buildbot

Create and switch to the buildbot account:

   useradd -d /var/lib/buildbot -u 101 -s /bin/bash -m buildbot
   su - buildbot
   touch .k5login
   edit .profile and add:
     PATH=/usr/local/bin:/opt/csw/bin:/usr/bin:/usr/sfw/bin:/usr/ccs/bin
     MANPATH=/usr/local/share/man:/opt/csw/share/man:/usr/share/man:/usr/sfw/share/man
     USER=buildbot
     export PATH MANPATH USER

Principals may be added to .k5login, but make sure it exists so that the Kerberos principal "buildbot" does not have access to the account.

Set up ssh for the ssh tunnel to krbdev-buildbot.mit.edu:

   mkdir .ssh
   ssh-keygen -q -N '' -f .ssh/id_rsa -t rsa
   cat .ssh/id_rsa.pub
   In a separate shell, log into krbdev-buildbot.mit.edu, "su -s /bin/bash - buildbot" and add the contents of id_rsa.pub to .ssh/authorized_keys
   Run "/usr/bin/ssh -l buildbot krbdev-buildbot.mit.edu" to add the host key to .ssh/known-hosts.  Check the key fingerprint against "ssh-keygen -l -E md5 -f /etc/ssh/ssh_host_rsa_key.pub"

Create the slave directory:

   mkdir slaves
   buildslave create-slave /var/lib/buildbot/slaves/s01 127.0.0.1:9989 s01 password

where password should match the entry for s01 in slaves.py on krbdev-buildbot.mit.edu.

As root, create /etc/init.d/buildslave with the contents:

   #!/sbin/sh
   case "$1" in
   start)
       su buildbot -c 'ssh -l buildbot -N -L9989:127.0.0.1:9989 krbdev-buildbot.mit.edu &'
       su - buildbot -c 'buildslave start --quiet /var/lib/buildbot/slaves/s01'
       ;;
   stop)
       su buildbot -c '/opt/csw/bin/buildslave stop --quiet /var/lib/buildbot/slaves/s01'
       ;;
   esac
   exit 0

Make it executable with "chmod u+x /etc/init.d/buildslave". Create the following links:

   ln -s /etc/init.d/buildslave /etc/rc2.d/S99buildslave
   ln -s /etc/init.d/buildslave /etc/rc2.d/K00buildslave

We do not currently stop the ssh tunnel automatically, because it isn't easy to do. The ssh tunnel must be manually restarted if it breaks; on other workers, we use a cron job which runs "ssh -oExitOnForwardFailure=yes ...", but the Solaris 10 ssh does not support that option. The start rule will display an unwanted copy of /etc/motd; an alternative would be to explicitly set the path when running buildbot, instead of relying on buildbot's .profile.

Create user accounts

By default, /home on Solaris is controlled by the automounter. To avoid needing to change the automounter configuration, we create user accounts with home directories in /export/home. For example:

   useradd -u 3622 -d /export/home/ghudson -s /bin/bash -m ghudson

Creating an account allows the Kerberos principal of the same name in the ATHENA.MIT.EDU realm to log in on that account. Matching the local UID to the Moira UID may be unnecessary as long as we do not make use of remote filesystems on this machine.

To set a reasonable path for development work, the user can edit .profile to add:

   PATH=/usr/local/bin:/opt/csw/bin:/usr/bin:/usr/sfw/bin:/usr/ccs/bin
   MANPATH=/usr/local/share/man:/opt/csw/share/man:/usr/share/man:/usr/sfw/share/man
   export PATH MANPATH

The following shell function, or a variant of it, may be useful for configuring a build with the correct paths. This variant is designed to work in a separate build directory placed next to the src directory within a checkout.

   k5configure() { ../src/configure --enable-maintainer-mode --prefix=$HOME/inst --with-ldap CFLAGS=-g CPPFLAGS="-I/opt/csw/include" LDFLAGS="-L/opt/csw/lib -R/opt/csw/lib" "$@"; }

To do

  • We should install the SunPro compiler and do automated builds with that compiler as well as gcc.

Hardware notes

The 8-pin modular serial connector for console/ALOM takes a shielded UTP cable. (The shielding probably isn't too important except for EMI reasons.) The modular to female DE-9 adapter is wired as a RS-232 DCE so it will plug directly into most USB to DE-9 RS-232 adapters. (The modular to male DB-25 adapter seems to be wired as a DTE and might need a null modem.)